Splunk Search

How to search for errors that contain asterisks (*)?

New Member

I have what I hope is a simple question. We have response logs from different payers. If they are having system issues, they will respond with a “AAA” code. In this case AAA*Y**42*. How can I filter for these? When I search for AAA*Y**42* I get responses with AAA or Y or 42.

Sorry for the newbie question

0 Karma

Esteemed Legend

Try this:

index=YourIndexHere sourcetype=YourSourceTypeHere (AAA OR Y OR 42)
| regex "AAA\*Y\*\*42\*"
0 Karma


Hi cj039165, the regex command could be useful here, i.e.

sourcetype=your_system_issues_sourcetype | regex "AAA\*Y\*\*42\*"

This will filter all events that match that pattern.

Please let me know if this answers your question!

0 Karma


Try term(AAA*y**42*)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!